Internal Auditing and Temporally Organized Practice of Risk Management: A Field Study of a Public Sector Organization in Malaysia

Abstract

The study considers the role of an internal audit department (IAD) in developing risk management practices in a Malaysian public sector organization (hereinafter referred to as AbC) through a theorization of institutional work and “knowledgeable supervision.” On the basis of an intensive field study of little more than a year, data were collected through interviews, archival documents, shadowing internal auditors, and observations of meetings. In this study, we show that the involvement of internal auditors in risk management activities is shaped by the ways in which they enact, construct, and manage temporality within which they operate and make sense of their activities. The internal auditors enacted and constructed timing norms of risk management through various types of institutional works and changed their role from critical friend to third line of defense as an intelligible response to shared temporal understanding in the organization. In addition, we show the importance of risk communication in strengthening the network of knowledgeable supervision of risk management and highlight challenges faced by internal auditing in fostering public value within their organizational activities.